New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 817469 link

Starred by 1 user

Issue metadata

Status: Assigned
Owner:
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Mac
Pri: 2
Type: Bug



Sign in to add a comment

Copy as cURL body formatting does not work for null bytes

Reported by jo...@limelighthealth.com, Feb 28 2018

Issue description

UserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.186 Safari/537.36

Steps to reproduce the problem:
1. Open the network log in a new tab
2. Visit this codepen: https://codepen.io/anon/pen/XZOmKd
2. Select Copy > Copy as cURL
3. Paste into a terminal
4. Add the `-v` flag to the request, and press enter

What is the expected behavior?
The sent content-length should be 1, and the null byte should be sent

What went wrong?
Instead, the content-length is zero, and the null byte is not sent.

Did this work before? No 

Chrome version: 64.0.3282.186  Channel: stable
OS Version: OS X 10.13.3
Flash Version: 

This can be fixed by changing how the binary body is formatted.  For example, this is the cURL command you would get from the request above:

curl 'http://www.example.org/example.txt' -H 'Origin: https://s.codepen.io' -H 'Content-Type: text/plain;charset=UTF-8' --data-binary $'\x00a' --compressed

If you change it to use printf instead of a $ string, it behaves as expected:

curl 'http://www.example.org/example.txt' -H 'Origin: https://s.codepen.io' -H 'Content-Type: text/plain;charset=UTF-8' --data-binary "$(printf '\x00a')" --compressed

(output)

> POST /COPY_ME_AS_CURL HTTP/1.1
> Host: www.example.org
> User-Agent: curl/7.54.0
> Accept: */*
> Accept-Encoding: deflate, gzip
> Origin: https://s.codepen.io
> Content-Type: text/plain;charset=UTF-8
> Content-Length: 1
> 
* upload completely sent off: 1 out of 1 bytes

You can further explore the difference between $'' and printf with these commands:

$ echo -n $'\x00a' | hexdump -C
$ printf '\x00a' | hexdump -C
 
After some further testing, I've discovered that bash doesn't actually support null bytes in strings.  To avoid ever storing it in a string, it needs to be piped in.  This example will actually send all bytes, including the null bytes:

printf '\x00a' | curl 'http://www.example.org/example.txt' -H 'Origin: https://s.codepen.io' -H 'Content-Type: text/plain;charset=UTF-8' --data-binary @- --compressed

(output)

> POST /example.txt HTTP/1.1
> Host: www.example.org
> User-Agent: curl/7.54.0
> Accept: */*
> Accept-Encoding: deflate, gzip
> Origin: https://s.codepen.io
> Content-Type: text/plain;charset=UTF-8
> Content-Length: 2
> 
* upload completely sent off: 2 out of 2 bytes

Note the content-length of 2 bytes now.
Labels: Needs-Triage-M64
Cc: sindhu.chelamcherla@chromium.org
Labels: Triaged-ET Needs-Feedback
Unable to reproduce this issue on reported version 64.0.3282.186 using Mac 10.13.3 with steps mentioned below.

1. Opened NTP and Opened devtools Network tab.
2. Navigated to https://codepen.io/anon/pen/XZOmKd and selected first entry from network log and selected copy as cURL.
3. Pasted into terminal and appended -v at last and pressed enter. Text observed is pasted in text file.

@Reporter: Please check the video and let us know if we miss anything. Also please clarify step#1, open network tab or network log. If it is network log please attach a sample log to test this issue. Further info would help us in triaging the issue in a better way.

Thanks!
817469.rtf
5.4 KB Download
817649.mp4
3.5 MB View Download

Comment 4 by alph@chromium.org, Mar 2 2018

Owner: eostroukhov@chromium.org
Status: Assigned (was: Unconfirmed)
Hi Sindhu,

I apologize, my instructions were not as clear as I thought.

1. Visit this CodePen: https://codepen.io/anon/pen/XZOmKd
2. Open the dev tools and go to the Network tab
3. Click the "Send Null Bytes" button in the CodePen output
4. Right-click on the network log item named "COPY_ME_AS_CURL" and select Copy > Copy as cURL
5. Paste into a terminal, append the `-v` flag, and press enter

Expected outcome:

Content-length header should be 2, and cURL should send 2 bytes.

Actual outcome:

Content-length header is 0, and no request body is sent.

Here's an example command I copied:

curl 'http://www.example.org/COPY_ME_AS_CURL' -H 'Origin: https://s.codepen.io' -H 'Content-Type: text/plain;charset=UTF-8' --data-binary $'\x00a' --compressed
Owner: jarhar@chromium.org

Sign in to add a comment